Arbitrary File Write Vulnerability in Electerm FTP/SFTP Client
CVE-2026-73225

8.1HIGH

Key Information:

Vendor

Electerm

Status
Electerm
Vendor
CVE Published:
11 August 2026

What is CVE-2026-73225?

The Electerm open-source terminal client suffers from an arbitrary file write vulnerability that allows malicious FTP or SFTP servers to exploit recursive transfers. This occurs due to insufficient sanitization of user-supplied values in file transfers, enabling attackers to write potentially harmful content outside the designated download directory. The issue has been addressed in version 3.15.120, emphasizing the importance of keeping software up to date to protect against vulnerabilities.

Affected Version(s)

electerm < 3.15.120

References

https://github.com/electerm/electerm/security/advisories/...
x_refsource_CONFIRM
https://github.com/electerm/electerm/commit/deee11ffe558e...
x_refsource_MISC
https://github.com/electerm/electerm/releases/tag/v3.15.120
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.